Transcript
A (0:00)
From the CISO series, it's Cybersecurity Headlines.
B (0:07)
These are the cybersecurity headlines for Tuesday, December 2, 2025. I'm Sarah Lane. India orders Pre Installed Web Safety app the Indian government has ordered smartphone makers to pre install its state owned cybersecurity app Sanchar Sati on all new devices within 90 days and push it to existing phones. The app launched in January and helps block stolen phones, fraudulent connections and recovered lost devices. More than 5 million users have downloaded it. Apple and privacy advocates are expected to push back because the mandate removes user choice and may conflict with Apple's pre sale app policies. Arrests in South Korea over IP camera snooping South Korean police arrested four people accused of hacking more than 120,000 IP cameras with two suspects allegedly selling footage for around tens of thousands of dollars. In Australia, a 44 year old received a minimum five year sentence for running evil twin wi fi traps on flights and at airports to steal credentials and access victims private photos. And in the uk, a Norfolk man was sentenced to six and a half years for operating a dark web drug business under the name DNM Soldiers. NDD Albertox Malware shows up on Dark Web Android malware called Alberiox has shown up on Russian cybercrime forums offering full device takeover and real time fraud. Researchers at Kleefi say it targets more than 400 banking and crypto apps and started offering public subscriptions back in October starting at $650 per month. Early campaigns focused on Austrian users through phishing pages and a fake Google Play site distributing a Trojanized penny market app. AlberiaX supports VNC based remote control, credential harvesting, UI automation, black screen overlays and uses GoldenCrypt to evade detection. Shadypanda turns browser extensions into Spyware Koi Security reports that a China linked group called Shadypanda spent seven years turning once legitimate Chrome and Edge extensions into spyware, affecting more than 4.3 million installs. Several extensions received malicious updates in mid 2024 that allowed hourly remote code execution, full browsing surveillance, encrypted data, exfiltration and adversary in the middle attacks. Another batch of extensions logged every URL, visit, query, click and cookie with WeTab alone reaching 3 million install. Huge thanks to our sponsor Vanta. This message comes from Vanta. What is your 2am Security worry? Is it do I have the right controls in place or are my vendors secure? Enter Vanta Vanta automates manual work so you can stop sweating over spreadsheets, chasing audit evidence and filling out endless questionnaires their trust management platform continuously monitors your systems, centralizes your data and simplifies your security at scale. Get started at Vanta Ciso that's Vanta V a n t a dot Ciso authorities take down Cryptomixer European authorities shut down Cryptomixer, a crypto mixing service that allegedly laundered more than $1.5 billion in Bitcoin since since 2016. As part of Operation Olympia. Investigators seized nearly 28 million in Bitcoin, three servers in Switzerland, the domain and 12 terabytes of data. Europol called Cryptomixer a platform of choice for ransomware groups, fraud operations and drug and weapons traffickers. Coupang data breach impacts millions of South Korea's largest retailer, Coupang, disclosed a data breach affecting 33.7 million customers. The incident was discovered Nov. 18 and exposed names, phone numbers, emails, addresses and order details, but not payment information or passwords. The breach reportedly began at June 24, possibly involving a former employee using unrevoked access tokens. Coupang has notified authorities and will inform affected users, urging vigilance against phishing Malware manipulates AI detection in Package Breach, a malicious NPM package was found using prompt text to manipulate AI based code scanners while actually operating as a supply chain compromise. It typo squatted. The trusted ESLint plugin, ran a post install hook, harvested environment variables and exfiltrated data via a pipedream webhook. Earlier versions were flagged in February of 2024, but NPM didn't remove the package, which now has nearly 17,000 installs. Dutch study Teen Cybercrime a Phase A Dutch government report finds that teenage cybercrime is largely a phase, with most offenders stopping by age 20. Only about 4% continue into adulthood. Typically driven by ongoing curiosity and skill building rather than money, cybercrime among teens is less common than property offenses, but mirrors peak ages of other crimes. While the social cost of all adolescent crime in the Netherlands is around 10.3 billion euros annually, cybercrime's specific impact is not known. Remember to subscribe to the CISO Series YouTube channel. We've been posting new shorts every weekday and if you enjoy the daily headlines, make sure to subscribe to get a little bonus video every day. We're almost at 10,000 subscribers. We're very excited about this and we'd love it if you can help us hit that milestone before the end of the year. If you have some thoughts on the news from today or about our show in general, be be sure to reach out to us@feedbackisoseries.com we want to hear from you. I am Sarah Lane, reporting for the CISO series. Thank you for listening, and we'll talk to you tomorrow.